LOL · OtherMSBinary

AccCheckConsole.exe

2 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Load a managed DLL in the context of AccCheckConsole.exe. The -window switch value can be set to an arbitrary active window name.

Use Local execution of managed code from assembly DLL.

AccCheckConsole.exe -window "Untitled - Notepad" {PATH_ABSOLUTE:.dll}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_lolbin_susp_acccheckconsole.yml
IOC: Sysmon Event ID 1 - Process Creation
Analysis: gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340
Refs: gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340
twitter.com/bohops/status/1477717351017680899
lolbas-project.github.io/lolbas/OtherMSBinaries/AccCheckConsole/

AWL / Policy BypassWindows

Load a managed DLL in the context of AccCheckConsole.exe. The -window switch value can be set to an arbitrary active window name.

Use Local execution of managed code to bypass AppLocker.

AccCheckConsole.exe -window "Untitled - Notepad" {PATH_ABSOLUTE:.dll}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: AWL Bypass
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_lolbin_susp_acccheckconsole.yml
IOC: Sysmon Event ID 1 - Process Creation
Analysis: gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340
Refs: gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340
twitter.com/bohops/status/1477717351017680899
lolbas-project.github.io/lolbas/OtherMSBinaries/AccCheckConsole/